Bugs:Dr. Mario (NES)
This page details bugs of Dr. Mario (NES).
Contents
Controller Polling Bugs
The game can occasionally re-register held inputs or otherwise register spurious inputs. The easiest method to reproduce this is to start on a low level with Low speed and Chill as the music, then move the pill around while holding a rotation button. Occasionally, the pill will rotate as if the rotation button was pressed again.
Cause of the Bugs
Due to a hardware flaw on JP/US systems, the controller inputs can become corrupted while DPCM samples are playing. The game polls the controllers twice (including the Famicom's expansion port) and bitwise ANDs the results to work around this. The intent was to only keep button inputs which appear in both reads.
However, this assumes that the input corruption is a bit flip. In reality, the input corruption is a bit deletion. All the bits after the deleted one will be shifted from their original positions once the controller polling has completed. The result of this is that buttons held in both reads have a chance of not matching because their bit positions have shifted. Likewise, bits from unrelated buttons have a chance of matching anyway due to the bit shift.
Workarounds
As mentioned on the main page, the game contains unused controller polling routines with different workarounds. Unfortunately, these have their own flaws (ROM offsets are for JP/US Rev 1):
- $B812 contains a routine which rereads the standard controllers in a loop until two polls match, which is a workaround seen in many commercial games. This routine ignores the expansion port, which is problematic for Famicom users who cannot use the hard-wired controllers for whatever reason.
- $B828 contains a routine which is identical to the previous one but combines inputs from the expansion port. It is slow enough to have two input corruptions happen consecutively when the DMC playback rate is at its maximum (i.e. the highest drum sample pitch). This usually manifests itself in the form of spurious right presses when no inputs are being held (very apparent on the level select screen).
The Game Genie codes which fix the below glitch will also fix the controller polling bugs, albeit with minor side effects on JP/US systems.
The best workaround is to turn off the music altogether to prevent the input corruption from happening in the first place.
The European version does not suffer from any of this as the underlying hardware flaw was fixed.
Big Combo Glitch
The game can glitch out or crash when a combo erases a large amount of pills/viruses simultaneously.
Cause of the Glitch
The game has a table of point multipliers which is indexed by the number of viruses cleared in a combo. The game then enters a "virus erasure loop", where the multiplier value is used as a loop counter to add the points for a single virus clear. The loop counter is decreased at the end of each loop until it reaches 0. (Note that separate loops are used for horizontal and vertical clears.)
When the combo is too big, the point multiplier table is indexed out of bounds. Notably, the 14th "entry" contains $00. This value is decremented at the end of the loop and underflows to $FF, causing the loop to run an additional 255 times (i.e. the loop runs 256 times, multiplying the single clear point value by a drastic amount).[1]
While the game is busy processing this loop, an unexpected NMI is triggered and the controllers are polled (normally, the game logic runs fast enough that the CPU can wait for an NMI in a safe state). The controller polling routine shares temporary zeropage variables ($48-$49) with those used to control the virus erasure loop, including the loop counter. As a result, the controller inputs overwrite the shared variables and causes the virus erasure loop to get stuck.
The nature of the glitch makes it possible to press buttons on Controller 2 in such a way that the loop eventually exits, resuming gameplay. Tool-Assisted Speedruns abuse this to clear levels much faster than intended.
Fixing the Glitch
The game contains unused variants of the controller polling routine which do not use conflicting variables, thus avoiding the crash.
The following Game Genie codes will switch the polling routine to the unused "safe" variants:
| Revision | Codes |
|---|---|
| JP/USA Rev 1 | ZPKOZPOT ELKOLPNU |
| JP Rev 0 | EYUOZPNK |
| EU | YPKPLPEI ELKPGPNU |
Side effects: The expansion port will be ignored on JP/US. The EU version will retain expansion port compatibility.
